test(saas): fix HTTPError mock, assert Bearer token, add run_id test; trim docstring

- Fix urllib.error.HTTPError mock: hdrs=None → http.client.HTTPMessage()
  (prevents AttributeError on Python versions that read headers from error)
- test_saas_route_taken_and_bearer_token_sent: assert Authorization header
  contains the correct Bearer token (was only checking routing, not auth)
- test_saas_run_id_forwarded: verify run_id reaches the SaaS payload
- docstring: remove hardcoded 5s/65s values, reference constants by name only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: node9ai

node9/_client.py

@@ -288,9 +288,8 @@ def evaluate(tool_name: str, args: dict[str, Any], *, run_id: str = "") -> None:
       - Daemon timeout / connection closed  → ActionDeniedException (fail-closed)
       - SaaS HTTP error or timeout          → RuntimeError (propagates to caller)
 
-    Timeouts (see _CHECK_TIMEOUT / _WAIT_TIMEOUT module constants):
-      - Initial connection: 5 s
-      - Waiting for human decision: 65 s — daemon auto-denies at ~55 s
+    Timeouts: see _CHECK_TIMEOUT (initial connection) and _WAIT_TIMEOUT
+    (human decision wait) module constants for current values.
 
     ⚠️  evaluate() is a low-level primitive. Unlike @protect it does NOT run DLP
     scanning or inject agent context (run_id, agent_name) automatically. Use

tests/test_client.py

@@ -336,8 +336,9 @@ def test_offline_with_require_approval_policy_warns(self, monkeypatch, tmp_path)
 class TestSaaSRoute:
     """Tests for the NODE9_API_KEY → SaaS routing path."""
 
-    def test_saas_http_error_raises_runtime_error(self, monkeypatch, tmp_path):
+    def test_saas_http_error_raises_runtime_error(self, monkeypatch):
         """SaaS HTTP errors (e.g. 401, 500) must propagate as RuntimeError, not auto-approve."""
+        import http.client
         import urllib.error
         monkeypatch.setenv("NODE9_API_KEY", "test-key")
         monkeypatch.setenv("NODE9_API_URL", "https://api.node9.ai/api/v1/intercept")
@@ -346,7 +347,7 @@ def test_saas_http_error_raises_runtime_error(self, monkeypatch, tmp_path):
             url="https://api.node9.ai/api/v1/intercept",
             code=401,
             msg="Unauthorized",
-            hdrs=None,  # type: ignore[arg-type]
+            hdrs=http.client.HTTPMessage(),
             fp=None,
         )
         with patch("urllib.request.urlopen", side_effect=http_error):
@@ -363,17 +364,45 @@ def test_saas_url_error_raises_runtime_error(self, monkeypatch):
             with pytest.raises(RuntimeError, match="Failed to reach node9 SaaS"):
                 evaluate("bash", {"command": "ls"})
 
-    def test_saas_route_taken_when_api_key_set(self, monkeypatch):
-        """When NODE9_API_KEY is set the SaaS path is taken regardless of daemon state."""
-        monkeypatch.setenv("NODE9_API_KEY", "test-key")
+    def test_saas_route_taken_and_bearer_token_sent(self, monkeypatch):
+        """When NODE9_API_KEY is set: SaaS path is taken and Bearer token is in the request."""
+        monkeypatch.setenv("NODE9_API_KEY", "test-key-abc")
         monkeypatch.setenv("NODE9_API_URL", "https://api.node9.ai/api/v1/intercept")
 
+        captured_headers: list[dict] = []
         approve_resp = _make_response({"approved": True})
-        with patch("urllib.request.urlopen", return_value=approve_resp):
+
+        def capturing_urlopen(req, timeout):
+            captured_headers.append(dict(req.headers))
+            return approve_resp
+
+        with patch("urllib.request.urlopen", side_effect=capturing_urlopen):
             with patch("node9._client._daemon_reachable") as mock_check:
                 evaluate("bash", {"command": "ls"})
-        # daemon reachability must NOT be checked when API key is present
+
         mock_check.assert_not_called()
+        assert captured_headers, "urlopen was never called"
+        auth = captured_headers[0].get("Authorization", "")
+        assert auth == "Bearer test-key-abc", f"Expected Bearer token, got: {auth!r}"
+
+    def test_saas_run_id_forwarded(self, monkeypatch):
+        """run_id is included in the SaaS request payload."""
+        monkeypatch.setenv("NODE9_API_KEY", "test-key")
+        monkeypatch.setenv("NODE9_API_URL", "https://api.node9.ai/api/v1/intercept")
+
+        sent: list[dict] = []
+        approve_resp = _make_response({"approved": True})
+
+        def capturing_urlopen(req, timeout):
+            if hasattr(req, "data") and req.data:
+                sent.append(json.loads(req.data))
+            return approve_resp
+
+        with patch("urllib.request.urlopen", side_effect=capturing_urlopen):
+            evaluate("bash", {"command": "ls"}, run_id="saas-run-xyz")
+
+        assert sent, "No request was sent"
+        assert sent[0].get("runId") == "saas-run-xyz"
 
 
 class TestConfigure: